Printable View
Hi all, just setting up a lab at home to test out some IDS's and the like.
I've installed a Windows 2003 server and am running a port scan against it from another PC. It doesn't show port 3389 as 'listening' yet I know it is because 1 - I can connect to it using Terminal Services client and 2 - a 'netstat -an' on the server itself shows the port as listening.
And.... There is no firewall on the server. There was but I disabled it.
Any ideas why it wouldn't show on a scan? I'm just curious....
What portscanner are you using, and with what options?
Are you scanning the UDP or TCP port? - they have the same number but are different ports.
I was using Superscan 4.0, didn't set any options, just entered the IP and started the scan, then viewed the results in HTML after. It just showed the NETBIOS port 137 as being open.
Actually guys (and gals) using another scanner it showed up. Maybe that Superscan isn't so great or I possibly didn't set something correctly (the more likely option).
Hello - I have had multiple issues with SuperScan in the past but I still use it as I prefer its functionality and output.
2 questions though:
1. Did you select the TCP scan? If so, is it on SYN or Connect. (I find that only Connect works on my XP machines.)
2. Is port 3389 in your list of ports being scanned? SuperScan only scans for what you tell it to scan.
If all else fails, just Nmap. :)
Hope that helps,
-Deeboe
Not sure if superscan 4 is the new release or the one before it, but the old one only scans TCP ports.
I see! I just set Superscan to TCP 'connect' and re-ran the scan and it picked up Port 3389.
Thanks for the advice, I didn't realise some of these scanners had to be told what to do so much.
Have you tried any other ones? I've never liked superscan.(im not saying its no good, just that I dont like it)
Nmap is good but you may have to have a good read through the manual pages before you use it, or I personally prefer LANguard, whilst it is not strictly a port scanner (its more of a vulnerability scanner) it is very easy to use and is extremely reliable.
We use Superscan fairly often to test responsiveness of IDS sensors. Its quick and relatively easy yet has enough options to trip several alerts. I believe the version we are using is 4.0. If you check out the different tabs across the top, you get some interesting options. When testing IDS responsiveness, try the tab at the top that says Windows Enumeration. Some of those options will trip an IDS. Try creating your own custom port range to sweep... such as known trojan ports.
Its quick, its simple and very small learning curve to implement.
Obviously if you want a larger range of alerts to be tripped, you can pull out some of the heavier guns as Nokia mentioned... Nmap, LANguard, Nessus, etc... some of the live cd's have a lot of great tools like Whoppix (whax) and another I read about today here on AO.....Pentoo
(http://www.antionline.com/showthread...hreadid=273577)
The Superscan 4.0 help file gives this information about it's TCP Scan:Quote:
Originally posted here by Deeboe
Hello - I have had multiple issues with SuperScan in the past but I still use it as I prefer its functionality and output.
2 questions though:
1. Did you select the TCP scan? If so, is it on SYN or Connect. (I find that only Connect works on my XP machines.)
2. Is port 3389 in your list of ports being scanned? SuperScan only scans for what you tell it to scan.
If all else fails, just Nmap. :)
Hope that helps,
-Deeboe
TCP Port Scan
Enter ports and settings here to scan with TCP packets. There are 2 basic TCP port scanning methods:
Connect - performs a full TCP 3-way handshake.
SYN - only sends a SYN packet. To scan your localhost system you will need to use the Connect mode.
· · · · · ·
I have a question about this. What purpose does just a SYN scan acheive? You can send a SYN to every port on your target IP, sure you need something (a SYN/ACK) back to confirm there is an open port?
Or would you just use this to trip an IDS as part of your testing for SYN attacks and the like?
I've had some problems with SuperScan v4 not working properly like showing ports that are open initially and then not showing them on next scan, showing random ports open every other scan.
I went back to using SuperScan v3 which is pretty solid and reliable. Its a free tool from Foundstone who had taken it off their site but see it's back.
http://www.foundstone.com/resources/.../superscan.htm
Depending on where you are scanning (LAN, or Internet) you'll need to adjust the speed accordingly. I recommend keeping the speed bar around the middle and lower for slower networks.
Ive also had problems with Superscan, mainly versions before the latest. For each scan several ports would appear open when they weren't. Also I don't think SuperScan scans UDP ports...
For Windows I like to use Scanline by Foundstone, its a command line scanner but has great functionality. Though these days I solely use Linux for these sort of things.
Check it out.
http://www.foundstone.com/index.htm?...c/scanline.htm